Overview

overview

10

Static

static

3

2024-07-28...er.exe

windows7-x64

10

2024-07-28...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-07-28_8f355039fd3d9395f974e0982c13a458_avoslocker

  • Size

    2.1MB

  • Sample

    240728-c9kamsxbrg

  • MD5

    8f355039fd3d9395f974e0982c13a458

  • SHA1

    725df56eba3b235f996132057e3ef94d4cc39843

  • SHA256

    ba4e57be7998467a7fb5471ea6e6d5ee9d6233de96bf2699efe9e8c45b21b039

  • SHA512

    7d6d3b445b7d39d054a37f0c33845fdb0f936e48252e46bfe405ab4d2bbb00554dcaea24283f56ce4c5b7b64a7daef0929994405b0706b7937b3b42f6b24dfe8

  • SSDEEP

    24576:p22vSU1RUol7JFZUEHAlPPT7CP02yVYk8YzlRGaDEW4/oUxvCUD61CCQbKxvDUQa:bJUol1Fy+SPTey6IGqH4x5DeEKtUw9

Score
10/10
rhadamanthysdiscoverypersistencestealer

Malware Config

Targets

    • Target

      2024-07-28_8f355039fd3d9395f974e0982c13a458_avoslocker

    • Size

      2.1MB

    • MD5

      8f355039fd3d9395f974e0982c13a458

    • SHA1

      725df56eba3b235f996132057e3ef94d4cc39843

    • SHA256

      ba4e57be7998467a7fb5471ea6e6d5ee9d6233de96bf2699efe9e8c45b21b039

    • SHA512

      7d6d3b445b7d39d054a37f0c33845fdb0f936e48252e46bfe405ab4d2bbb00554dcaea24283f56ce4c5b7b64a7daef0929994405b0706b7937b3b42f6b24dfe8

    • SSDEEP

      24576:p22vSU1RUol7JFZUEHAlPPT7CP02yVYk8YzlRGaDEW4/oUxvCUD61CCQbKxvDUQa:bJUol1Fy+SPTey6IGqH4x5DeEKtUw9

    Score
    10/10
    rhadamanthysdiscoverypersistencestealer

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks